This vulnerability in designthemes Kids Heaven (versions up to 3.2) arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details. It is not a cloud service, so remediation depends on the product vendor's updates.

Successful exploitation allows an attacker with low privileges to execute arbitrary code or manipulate application logic via object injection, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This can lead to data breaches, system disruption, or further attacks within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application and monitor for suspicious activity related to deserialization. No vendor advisory or patch links are currently provided.